topic Specific parameters and trace information in visualization table in Dashboards & Visualizations

Specific parameters and trace information in visualization table

DarthHerm — Fri, 07 Mar 2025 19:22:56 GMT

Both my work and myself are new to Splunk and I'm developing some reports and dashboards for one of our applications.

This one dashboard I am working on includes a table of events showing when some reports are downloaded. The log file's sourcetype is _json_AuditFramework. I'm looking to include the parameters name @documentId and it's corresponding value to place into a table. Right now, the table syntax lists the parameters{}.value and when there's multiple parameters{}.name and parameters{}.values in the log, they will all show in the table.

Pending on the report, I'm including trace information as well and it's the same thing as the parameters. I haven't had luck with similar posts I found.

{"auditResultSets":null,"schema":"ref","storedProcedureName":"DocumentGetById","commandText":"ref.DocumentGetById","Locking":null,"commandType":4,"parameters":[{"name":"@RETURN_VALUE","value":0},{"name":"@DocumentId","value":123123}],"serverIPAddress":"100.100.100.100","serverHost":"WEBSERVER","clientIPAddress":"101.101.101.101","sourceSystem":"WebSite","module":"Vendor.PRODUCT.BLL.DocumentManagement","accessDate":"2025-03-06T17:26:47.4112974-07:00","userId":0000,"userName":"username","traceInformation":[{"type":"Page","class":"Vendor.PRODUCT.Web.UI.Website.DocumentManagement.ViewDocument","method":"Page_Load"},{"type":"Manager","class":"Vendor.PRODUCT.BLL.DocumentManagement.DocumentManager","method":"Get"}]}
Show syntax highlighted
host = WEBSERVER source = Logfile path sourcetype = _json_AuditFramework

Re: Specific parameters and trace information in visualization table

DarthHerm — Fri, 07 Mar 2025 20:59:52 GMT

Please disregard. Overthinking the issue and looking at setting up some field extractions.

Re: Specific parameters and trace information in visualization table

livehybrid — Fri, 07 Mar 2025 22:04:42 GMT

Hi @DarthHerm

I saw your message about doing field extractions, in the meantime have a look to see if this search helps?

index=your_index sourcetype=_json_AuditFramework | spath input=parameters output=parameters | spath input=traceInformation output=traceInformation | eval param_names=mvmap(parameters, mvindex(mvfield(parameters{}.name), mvindex(mvfield(parameters{}.value), 0))) | eval documentId=mvindex(mvfilter(match(param_names, "@DocumentId")), 1) | eval trace_info=mvmap(traceInformation, mvindex(mvfield(traceInformation{}.type), mvindex(mvfield(traceInformation{}.class), mvindex(mvfield(traceInformation{}.method), 0)))) | table documentId, trace_info, serverIPAddress, serverHost, clientIPAddress, userName

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will